Privacy Notice & Data Protection Policy

1. About This Privacy Notice & Data Controller

At RedAid Nigeria (formerly German Leprosy and Tuberculosis Relief Association / DAHW Nigeria, registered under Nigerian law as an incorporated trustee), we are committed to safeguarding the confidentiality, integrity, and privacy of personal data entrusted to us. References in this notice to "RedAid Nigeria", "RAN", "we", "us", or "our" refer to RedAid Nigeria.

This Privacy Notice is drafted in strict adherence to the Nigeria Data Protection Act (NDPA) 2023, the Nigeria Data Protection Commission (NDPC) General Application and Implementation Directive, and international best practice benchmarks including the General Data Protection Regulation (GDPR).

2. When Do We Collect Information About You?

We collect personal data from you in the following operational circumstances:

• Direct Interactions: When you contact our team via website contact forms, direct email correspondence, telephone inquiries, or visit our headquarters or state project offices in Benue, Edo, Taraba, and Delta.
• Recruitment & Procurement: When you submit job applications, consultant proposals, tender documents, or vendor registration files via our Tenders & Careers portal.
• Public Health & Research Collaborations: When academic institutions, health ministries, donor partners (The Global Fund, Stop TB Partnership, NLR, Effect Hope), or clinical investigators engage with RedAid Nigeria under formalized Memoranda of Understanding (MoUs).
• Website Browsing & Analytics: When you navigate redaidnigeria.org, technical telemetry and essential session cookies are processed to optimize delivery.

3. What Information Do We Collect?

The categories of personal data collected depend on the specific context of your interaction with RedAid Nigeria:

• Contact & Identification Data: Full name, organizational affiliation, job title, official email address, phone number, and postal address.
• Candidate & Professional Data: Curriculum Vitae (CV), cover letters, academic qualifications, employment history, professional references, and verification documentation.
• Procurement & Vendor Data: Company registration certificates (CAC), Tax Identification Numbers (TIN), bank account details for authorized disbursements, and compliance certifications.
• Technical & Telemetry Data: Anonymized Internet Protocol (IP) address, browser client type, operating system, pages viewed, time spent per page, and referral source. This technical data is aggregated and does not identify individuals.

4. How Do We Use Your Information?

Your personal information is used strictly and exclusively for legitimate humanitarian, clinical research, and administrative purposes:

• Inquiry Response & Stakeholder Dialogue: To respond promptly to technical inquiries, partnership requests, and humanitarian assistance consultations.
• Recruitment & Talent Evaluation: To evaluate candidate qualifications, conduct structured interviews, perform pre-employment background vetting, and execute employment contracts.
• Vendor Contracting & Financial Accountability: To process statutory purchase orders, verify deliveries of medical supplies, and execute compliant banking payments.
• Dissemination of Research & Clinical Guidelines: To distribute RedAid Nigeria scientific publications, clinical manuals, and annual reports to subscribed public health professionals and institutional partners.
• Platform Security & Infrastructure Maintenance: To monitor system uptime, prevent cyber intrusions, and enhance website responsiveness across desktop and mobile devices.

Zero Commercialization Guarantee: RedAid Nigeria does never sell, lease, trade, or commercialize your personal data to any third party for marketing or advertising purposes.

5. Who Has Access to Your Data & Data Processors

Access to personal data is restricted strictly on a need-to-know basis to authorized RedAid Nigeria personnel who are bound by confidentiality obligations.

Third-Party Data Processors

We engage carefully vetted third-party service providers to support our digital infrastructure under strict Data Processing Agreements (DPAs) that comply with Section 39 of the NDPA 2023:

• Cloud Hosting & Server Infrastructure: Enterprise-grade web servers with ISO 27001 certification, high-availability firewalls, and encrypted storage.
• Email Routing & Office Collaboration: Encrypted enterprise communications suites for organizational correspondence and file archival.
• Privacy-Compliant Web Analytics: Anonymized aggregated telemetry tracking to monitor website performance without tracking personal identifiers.

6. How Do We Keep Your Information Safe?

RedAid Nigeria deploys strict administrative, technical, and physical safeguards to prevent unauthorized access, accidental alteration, disclosure, or destruction of personal data:

• End-to-End Encryption (TLS/SSL): All data transmitted between your browser and our servers is encrypted using modern 256-bit Transport Layer Security (HTTPS).
• Role-Based Access Control (RBAC): Strict administrative privileges ensure that staff can only access data strictly required for their job functions.
• Content Security Policy (CSP): Rigid browser-level headers preventing Cross-Site Scripting (XSS), clickjacking, and unauthorized third-party script execution.
• Regular Vulnerability Audits: Periodic security testing and code reviews of all web components and server environments.

7. How Long Do We Retain Your Information?

We retain personal data only for the duration necessary to fulfill the specific purpose for which it was collected, or to satisfy legal, statutory, accounting, or donor reporting mandates:

• General Inquiries: Retained for up to 12 months following resolution of the communication.
• Job Applications (Unsuccessful): Retained for 6 months post-recruitment cycle, after which CVs and personal files are securely deleted, unless the candidate explicitly consents to inclusion in our talent pool.
• Vendor & Financial Records: Retained for 7 years in compliance with Nigerian Companies and Allied Matters Act (CAMA 2020) and Federal Inland Revenue Service (FIRS) requirements.
• Cookie Consent Logs: Stored locally in your browser for 12 months, after which re-consent is requested.

8. Our Legal Basis for Processing Personal Data

Under Section 25 of the Nigeria Data Protection Act 2023, RedAid Nigeria relies on the following lawful bases for processing personal data:

• Consent (Section 25(1)(a)): Where you have given explicit consent, such as opting into cookie categories or subscribing to digital publications. You retain the right to withdraw consent at any time.
• Performance of Contract (Section 25(1)(b)): Where processing is necessary to execute an employment agreement, consultancy contract, or procurement purchase order.
• Legal Obligation (Section 25(1)(c)): Where processing is mandatory under statutory Nigerian laws, including CAMA 2020, tax laws, and National Health reporting mandates.
• Legitimate Interests (Section 25(1)(f)): Where processing is necessary for the legitimate humanitarian and operational management of RedAid Nigeria, without overriding your fundamental privacy rights.

9. Your Data Subject Rights (NDPA 2023 & GDPR)

As a data subject under the Nigeria Data Protection Act 2023, you possess comprehensive legal rights regarding your personal information:

• Right to Access: You have the right to request a copy of the personal data RedAid Nigeria holds concerning you.
• Right to Rectification: You may request immediate correction of inaccurate, incomplete, or outdated personal data.
• Right to Erasure ("Right to Be Forgotten"): You may request the deletion of your personal data where there is no compelling legal ground for continued processing.
• Right to Restrict Processing: You have the right to request a temporary pause on data processing while accuracy or objections are being evaluated.
• Right to Data Portability: You may request the transfer of your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You have the right to object at any time to processing based on legitimate interests.
• Right to Lodge a Complaint: You have the right to lodge a formal complaint with the Nigeria Data Protection Commission (NDPC) via www.ndpc.gov.ng if you believe your privacy rights have been violated.

To exercise any of these statutory rights, please email our Data Protection Officer directly at [email protected]. Requests are responded to within 30 days without charge.

10. Cookies, Tracking & Cookie Preferences Manager

Cookies are small text files placed on your computer or mobile device when you visit websites. They help the platform function efficiently, improve browsing performance, and provide anonymous usage metrics.

Categories of Cookies We Use

11. Data Protection Officer (DPO) & Contact Details

If you have any questions, concerns, requests, or complaints regarding this Privacy Notice or how RedAid Nigeria handles your personal data, please contact our designated Data Protection Officer: